Tagged Questions
3
votes
1answer
585 views
how do extended validation X.509 certs work?
https://www.forumatic.com/ uses an extended validation cert. wikipedia.org's entry on extended validation certs says that a cert is known to be an extended validation cert if the OID in the ...
1
vote
1answer
86 views
valid intermediate certs not in browser
Say an X.509 cert is signed by an intermediate cert that's not in your browser. Maybe the root certificate is but not the intermediate cert. At that point it seems like a valid certification path ...
2
votes
1answer
86 views
self-signed certs that aren't the final certificates in the path
The X.509 spec makes frequent statements like this:
(b) If certificate i is self-issued and it is not the final
certificate in the path, skip this step for certificate i.
How can you have ...
8
votes
2answers
290 views
X.509 certificate policies question
I asked another question about certificate policy mappings. This is a different issue. This is about Certificate Policies.
To quote from the X.509 RFC:
In an end entity certificate, these ...
1
vote
1answer
217 views
X.509 certificate policy mapping question
So I'm a little confused how X.509 certificate policy mappings work. So let's say the following depicts my cert chain:
root CA ---> intermediary CA ---> client cert
Would the root CA have a ...
0
votes
1answer
209 views
id-ce-cRLDistributionPoints ASN.1 / DER encoding question
I have a file - test.pem - with the following contents:
-----BEGIN CERTIFICATE-----
MBIwEKAOoAwwCqMIMAZhBEFCQ0Q=
-----END CERTIFICATE-----
openssl asn1parse -inform PEM -in test.pem -i returns the ...
0
votes
1answer
245 views
question about implicitly tags in ASN.1
From the X.509 RFC, in the "Implicitly Tagged Module" section:
CRLDistributionPoints ::= SEQUENCE SIZE (1..MAX) OF DistributionPoint
DistributionPoint ::= SEQUENCE {
distributionPoint [0] ...
4
votes
1answer
443 views
X.509 algorithm identifier parameters vs. extension values
From the X.509 specs:
AlgorithmIdentifier ::= SEQUENCE {
algorithm OBJECT IDENTIFIER,
parameters ANY DEFINED BY algorithm OPTIONAL }
...
2
votes
1answer
448 views
Why doesn't asn1parse parse all DER encoding strings?
I have a file - crl.txt - that contains the following:
MDYwNKAyoDCGLmh0dHA6Ly93d3cyLnB1YmxpYy10cnVzdC5jb20vY3JsL2N0L2N0cm9vdC5jcmw=
It's from one of the extensions in a particular X.509 cert. Why ...
3
votes
1answer
470 views
parsing the id-ce-keyUsage extension in X.509 certs
I'm trying to decode an X.509 certificate and have a question regarding the decoding of the extensions. In particular, the octet string corresponding to id-ce-keyUsage (OID 2.5.29.15) is as follows:
...
